Attacks/Breaches
2/10/2009
11:53 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Security Websites Hit By Big DDoS Attack

Metasploit still under siege in a third round of attacks as of this morning

Several renowned white-hat hacker security sites have been hit during the past few days with a distributed denial-of-service attack (DDoS). Immunity, Milw0rm, and Packet Storm were in the clear as of this posting, but attackers were still hammering away at Metasploit.

The attackers behind the DDoS -- which began on Feb. 6 and continued through the weekend on most of the sites -- deployed a massive botnet of some 80,000 zombies to flood the sites' domains with HTTP requests, according to Cisco researchers.

HD Moore, creator of Metasploit, says the DDoS' incoming connection rate exceeded 15 Mbps and used SYN packets. He has temporarily rerouted Metasploit's traffic here while he continues to gather more data on the attack as well as the culprit.

"It's the same flood, same request, etc., as the one on Friday," Moore says. The attack on Metasploit started with around 80,000 connections per second, and was at around 10,000 connections per second last night before rising again to around 60,000 later in the evening, he says.

Moore says the attack is not sophisticated, but it's "annoying."

"So far it just seems to be an ego thing -- someone with a chip on their shoulder and a botnet on hand being an idiot," says Moore, who is currently gathering a list of sources of the attack, which he plans to use to block the attacker altogether.

One of the other victimized security sites apparently tried this tack during the weekend, he says, and then the attacker switched from SYN to UDP packet flooding to keep the DDoS alive.

Moore says DDoS'ing an open-source project such as Metasploit is mainly a nuisance attack because "it's not like we're losing sales."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9209
Published: 2015-03-30
Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.